{"Id":"e6378671-986d-42a1-8e7a-717117c83751","Tags":["BioNTdrv.sys"],"Author":"Swachchhanda Shrawan Poudel","Created":"2025-03-02","MitreID":"T1068","CVE":["CVE-2025-0285","CVE-2025-0286","CVE-2025-0287","CVE-2025-0288","CVE-2025-0289"],"Category":"vulnerable driver","Verified":"TRUE","Commands":{"Command":"sc.exe create BioNTdrv.sys binPath=C:\\windows\\temp\\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys","Description":"Paragon Hard Disk Manager BioNTdrv.sys versions 10.1.x and older, 1.0.0.0, 1.1.0.0, 1.3.0.0, 1.4.0.0, and 1.5.1.0 contain five vulnerabilities that expose arbitrary kernel-memory mapping, write, and move operations, insecure kernel resource access, and a null-pointer dereference. Local attackers can use the affected driver to elevate to SYSTEM or cause a denial of service. CVE-2025-0289 has been observed in ransomware BYOVD attacks. Version 2.0.0 fixes the flaws.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://kb.cert.org/vuls/id/726882","https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/","https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/","https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"],"Acknowledgement":{"Person":"","Handle":""},"Detection":[],"KnownVulnerableSamples":[{"Filename":"BioNTdrv.sys","SHA256":"f83560719a0054cb9911811372d0fcb2d8b3704d30c5503cd0aeeccda3dc6b4b","MD5":"414904e1562e3fd9ea5d9539989b3f03","SHA1":"3e2b19b7111393987f0f8ba99693baef3ced5d56","Imphash":"6dfbd0e495cff008f6a4255e4df45629","Authentihash":{"MD5":"ed52d9d3f5f21a926a5223d5e2e6abe2","SHA1":"980f3b4a77d2fc3183d3772cd7f68edc45030ab7","SHA256":"7cb0ab6ed54b51910f2970a2a43513fdd7caa7bb0676d31578e75ac5482722ad"},"RichPEHeaderHash":{"MD5":"7401aa3df24fbfc370032cadfb358eb4","SHA1":"4aa0997457e2a5e84ac8524ec463d41a66645afb","SHA256":"5ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38"},"Sections":{".text":{"Entropy":6.047099724484535,"Virtual Size":"0x1414"},".data":{"Entropy":0.261554002666683,"Virtual Size":"0x140"},".pdata":{"Entropy":3.081599793071367,"Virtual Size":"0x48"},".idata":{"Entropy":4.3757173330499075,"Virtual Size":"0x5a0"},".rsrc":{"Entropy":3.200953482388757,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-12-07 08:03:10","Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","Product":"Paragon System Utilities","ProductVersion":"1.4.0","Copyright":"Copyright 1994-2020 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","ExGetPreviousMode","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","SeCaptureSubjectContext","SeReleaseSubjectContext","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","IoIs32bitProcess","PoRegisterSystemState","PoUnregisterSystemState","ObReferenceObjectByHandle","KeInitializeEvent","ZwOpenFile","ZwClose","ZwOpenProcess","PsLookupProcessByProcessId","KeAttachProcess","KeDetachProcess","ZwDuplicateObject","ObQueryNameString","SePrivilegeCheck","__C_specific_handler","IoFileObjectType","ObfDereferenceObject","RtlInitUnicodeString","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","ValidFrom":"2013-10-22 12:00:00","ValidTo":"2028-10-22 12:00:00","Signature":"3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0409181b5fd5bb66755343b56f955008","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"9359496ca4f021408b9d8923cab8b179","SHA1":"2aed40d7759997830870769be250199fd609e40e","SHA256":"e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65","SHA384":"5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA","ValidFrom":"2011-04-15 19:41:37","ValidTo":"2021-04-15 19:51:37","Signature":"5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611cb28a000000000026","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"983a0c315a50542362f2bd6a5d71c8d0","SHA1":"8047f476001f5cb16a661d2a3fd0c3576168f5e2","SHA256":"5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83","SHA384":"5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"}},{"Subject":"C=DE, ST=Baden,Württemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2020-08-15 00:00:00","ValidTo":"2021-11-05 12:00:00","Signature":"9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"02cebbc9e735228e41dbae6cfcc8a1db","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"e911e9028e84035051ad808ae54bc34b","SHA1":"d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40","SHA256":"db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45","SHA384":"825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"}}],"Signer":[{"SerialNumber":"02cebbc9e735228e41dbae6cfcc8a1db","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","Version":1}]}]},{"Filename":"BioNTdrv.sys","SHA256":"6415b01fbe1e2694547c472f3fad6e17ffb33efdfb44a89cbb623cbd4f731f2a","MD5":"42e7463e46255bf19b9b540d65ed304c","SHA1":"21da44b8390a07dfa88bc3cc3d100b6ee1ce7c6c","Imphash":"6dfbd0e495cff008f6a4255e4df45629","Authentihash":{"MD5":"d03a562dd5f28d6febb14fcfb7649b83","SHA1":"408490a6ab7e91c0e7b84bc933baccae2b65d02f","SHA256":"0fd3e7810b7af01db22a46964389f4483ef8d58b3468f32fd1b034bf80d63c2e"},"RichPEHeaderHash":{"MD5":"7401aa3df24fbfc370032cadfb358eb4","SHA1":"4aa0997457e2a5e84ac8524ec463d41a66645afb","SHA256":"5ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38"},"Sections":{".text":{"Entropy":6.0905021292805905,"Virtual Size":"0x115a"},".rdata":{"Entropy":3.5189324849769243,"Virtual Size":"0x374"},".data":{"Entropy":0.29193257727794475,"Virtual Size":"0x140"},".pdata":{"Entropy":3.06178925856097,"Virtual Size":"0x48"},"INIT":{"Entropy":4.719990969618506,"Virtual Size":"0x478"},".rsrc":{"Entropy":3.19570889855048,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-19 02:12:21","Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","Product":"Paragon System Utilities","ProductVersion":"1.0.0","Copyright":"Copyright 1994-2017 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","ExGetPreviousMode","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","SeCaptureSubjectContext","SeReleaseSubjectContext","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","IoIs32bitProcess","PoRegisterSystemState","PoUnregisterSystemState","ObReferenceObjectByHandle","KeInitializeEvent","ZwOpenFile","ZwClose","ZwOpenProcess","PsLookupProcessByProcessId","KeAttachProcess","KeDetachProcess","ZwDuplicateObject","ObQueryNameString","SePrivilegeCheck","__C_specific_handler","IoFileObjectType","ObfDereferenceObject","RtlInitUnicodeString","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, ST=Germany, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2016-07-14 00:00:00","ValidTo":"2017-09-11 23:59:59","Signature":"1199beae5e515ec84e737e0a25151a401914f99f5719a180106167aca6b849ede224eee294e58ddc2d3f08af3b67d5d295f3db95d302ce3f2856c0421f9ab82ab67ad09f1a8fbf092fad4f4808b3b18d34d1f32f7a4287f578e119bc37bda40aa7c51f0365546bbce2e55fb407f28eaffd68162d74b2457b29ebbdcf4698d6ebf005bf2261a267bd88d71d4311a6e29c85e609a2f5f428e21f3bc3ba121f88024257dd939891786ef106a130dc216fe09d4b58a6f4a1f52fa43664e099d92300c15c2d6f5f3ac058903b43e2023c66c41e97b015b40c048e07d8d7fcbfecb419e91a3853bd395d30d68e796da621a04e70776cdeba1689e8d78cc639bc645384","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"6ec648737d66ea562d9822552e1bce55","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b54dac562b3e3a8db6def401f69acac3","SHA1":"c412007e64e320f1e126a230e98676a58bfb1ec2","SHA256":"7632d627cfc09fff7b7dd7201a7b2b17d5abc1dc9a6b92c2079812705a528efb","SHA384":"0cd0562583ff91b7bea95a31d7a564938f04e90ee8fa40f9655701ec30ef03d8fc80b1e94cf71002ccc50e2d53656217"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"6ec648737d66ea562d9822552e1bce55","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"BioNTdrv.sys","SHA256":"69a9c8f3134130617f3bbe19a7221752d98f029763cd2d9100fec4680333ed16","MD5":"bee39ff7c8be071f14d1285596e6c34b","SHA1":"5cc6394fbfc6ea3638df534e0e069de536899171","Imphash":"1014dd148858e163ab9a4d27d0e3594a","Authentihash":{"MD5":"8a073d569af673fd00a46eea75cb5a57","SHA1":"7816451a304e92aa6f975e62bcee0746892ac8ca","SHA256":"c5062c8d91eda5579ee627746b367e37f60eb717f7148f6885ad6bcf315203d6"},"RichPEHeaderHash":{"MD5":"1e7257fad0156a8620120920a4eba3d1","SHA1":"81c0a25338b94e6f37fd4b008a96ec206578ae8c","SHA256":"28b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e"},"Sections":{".text":{"Entropy":6.183279202683356,"Virtual Size":"0x1abc"},".data":{"Entropy":0.261554002666683,"Virtual Size":"0x140"},".pdata":{"Entropy":3.4943370829119833,"Virtual Size":"0xc0"},".idata":{"Entropy":4.38491485631637,"Virtual Size":"0x574"},".rsrc":{"Entropy":3.197868142334446,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-19 02:12:20","Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","Product":"Paragon System Utilities","ProductVersion":"1.0.0","Copyright":"Copyright 1994-2017 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","PoRegisterSystemState","PoUnregisterSystemState","KeInitializeEvent","ObfDereferenceObject","ZwOpenFile","ZwClose","__C_specific_handler","IoFileObjectType","InbvAcquireDisplayOwnership","InbvDisplayString","InbvEnableDisplayString","InbvIsBootDriverInstalled","InbvResetDisplay","InbvSetScrollRegion","InbvSetTextColor","InbvSolidColorFill","InbvNotifyDisplayOwnershipLost","ObReferenceObjectByHandle","RtlInitUnicodeString","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, ST=Germany, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2016-07-14 00:00:00","ValidTo":"2017-09-11 23:59:59","Signature":"1199beae5e515ec84e737e0a25151a401914f99f5719a180106167aca6b849ede224eee294e58ddc2d3f08af3b67d5d295f3db95d302ce3f2856c0421f9ab82ab67ad09f1a8fbf092fad4f4808b3b18d34d1f32f7a4287f578e119bc37bda40aa7c51f0365546bbce2e55fb407f28eaffd68162d74b2457b29ebbdcf4698d6ebf005bf2261a267bd88d71d4311a6e29c85e609a2f5f428e21f3bc3ba121f88024257dd939891786ef106a130dc216fe09d4b58a6f4a1f52fa43664e099d92300c15c2d6f5f3ac058903b43e2023c66c41e97b015b40c048e07d8d7fcbfecb419e91a3853bd395d30d68e796da621a04e70776cdeba1689e8d78cc639bc645384","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"6ec648737d66ea562d9822552e1bce55","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b54dac562b3e3a8db6def401f69acac3","SHA1":"c412007e64e320f1e126a230e98676a58bfb1ec2","SHA256":"7632d627cfc09fff7b7dd7201a7b2b17d5abc1dc9a6b92c2079812705a528efb","SHA384":"0cd0562583ff91b7bea95a31d7a564938f04e90ee8fa40f9655701ec30ef03d8fc80b1e94cf71002ccc50e2d53656217"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"6ec648737d66ea562d9822552e1bce55","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"BioNTdrv.sys","SHA256":"e78f14d0adf4c5599b09d3995f84d265dbea20fc25112a9c3227b7a35910ca90","MD5":"d2fdad79aa8fc5c66687dc8516cab756","SHA1":"6ac13b7105b6bab8bfed4fe6f3d218c114aa7474","Imphash":"6dfbd0e495cff008f6a4255e4df45629","Authentihash":{"MD5":"edf14b6e661abc745b49e10e3da97bd4","SHA1":"aa141feaf476984e17aa906e9d80ea659e504d53","SHA256":"0da70668222c4472540ff820f70b70fa3a0243595880d9401adf60572c24b464"},"RichPEHeaderHash":{"MD5":"7401aa3df24fbfc370032cadfb358eb4","SHA1":"4aa0997457e2a5e84ac8524ec463d41a66645afb","SHA256":"5ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38"},"Sections":{".text":{"Entropy":6.097928597202249,"Virtual Size":"0x115a"},".rdata":{"Entropy":3.5201304006079104,"Virtual Size":"0x374"},".data":{"Entropy":0.29193257727794475,"Virtual Size":"0x140"},".pdata":{"Entropy":3.0895670363387477,"Virtual Size":"0x48"},"INIT":{"Entropy":4.719990969618506,"Virtual Size":"0x478"},".rsrc":{"Entropy":3.20961899705403,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-01-30 11:32:17","Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","Product":"Paragon System Utilities","ProductVersion":"1.3.0","Copyright":"Copyright 1994-2017 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","ExGetPreviousMode","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","SeCaptureSubjectContext","SeReleaseSubjectContext","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","IoIs32bitProcess","PoRegisterSystemState","PoUnregisterSystemState","ObReferenceObjectByHandle","KeInitializeEvent","ZwOpenFile","ZwClose","ZwOpenProcess","PsLookupProcessByProcessId","KeAttachProcess","KeDetachProcess","ZwDuplicateObject","ObQueryNameString","SePrivilegeCheck","__C_specific_handler","IoFileObjectType","ObfDereferenceObject","RtlInitUnicodeString","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, ST=Baden,Württemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2017-08-28 00:00:00","ValidTo":"2018-09-16 23:59:59","Signature":"b6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"247d157352d5671a5e44263793df43d2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"1a2e03e5b6dc284e5d998e6158740a72","SHA1":"1d0ed63f8c96e325d1ffb31c332f8596c305793d","SHA256":"3900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1","SHA384":"2508ac23775fa2b90f5a4117779a83be588f54f1e581751656f00af68a09b66c386f23b4d86e06e96531fc43b5e7fe23"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"247d157352d5671a5e44263793df43d2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"","Libraries":["ntoskrnl.exe","HAL.dll"],"ImportedFunctions":["KeWaitForSingleObject","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","PoRegisterSystemState","PoUnregisterSystemState","KeInitializeEvent","ObfDereferenceObject","ZwOpenFile","ZwClose","__C_specific_handler","IoFileObjectType","InbvAcquireDisplayOwnership","InbvDisplayString","InbvEnableDisplayString","InbvIsBootDriverInstalled","InbvResetDisplay","InbvSetScrollRegion","InbvSetTextColor","InbvSolidColorFill","InbvNotifyDisplayOwnershipLost","ObReferenceObjectByHandle","RtlInitUnicodeString","HalReturnToFirmware"],"ExportedFunctions":"","MD5":"ef32d203a12462403c205b39eb4eef5b","SHA1":"b31a85406ac9a6a69bfbee74d6dc67d9d7bddee6","SHA256":"fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0","Imphash":"1014dd148858e163ab9a4d27d0e3594a","Machine":"AMD64","MagicHeader":"50 45 0 0","CreationTimestamp":"2018-01-30 13:32:16","RichPEHeaderMD5":"1e7257fad0156a8620120920a4eba3d1","RichPEHeaderSHA1":"81c0a25338b94e6f37fd4b008a96ec206578ae8c","RichPEHeaderSHA256":"28b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e","AuthentihashMD5":"8d1f5412cc6e58af2bdbff2e179f298d","AuthentihashSHA1":"5d01cd9701213f7fd4073507cdbe18f4b742baf7","AuthentihashSHA256":"efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d","Sections":{".text":{"Entropy":6.1830696886313605,"Virtual Size":"0x1abc"},".data":{"Entropy":0.261554002666683,"Virtual Size":"0x140"},".pdata":{"Entropy":3.4943370829119833,"Virtual Size":"0xc0"},".idata":{"Entropy":4.38491485631637,"Virtual Size":"0x574"},".rsrc":{"Entropy":3.211778240837995,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"CompanyName":"Paragon Software GmbH","FileDescription":"A part of Paragon System Utilities","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","ProductName":"Paragon System Utilities","LegalCopyright":"Copyright 1994-2017 Paragon Software GmbH","ProductVersion":"1.3.0","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, ST=Baden,Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2017-08-28 00:00:00","ValidTo":"2018-09-16 23:59:59","Signature":"b6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"247d157352d5671a5e44263793df43d2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"1a2e03e5b6dc284e5d998e6158740a72","SHA1":"1d0ed63f8c96e325d1ffb31c332f8596c305793d","SHA256":"3900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1","SHA384":"2508ac23775fa2b90f5a4117779a83be588f54f1e581751656f00af68a09b66c386f23b4d86e06e96531fc43b5e7fe23"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"247d157352d5671a5e44263793df43d2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Authentihash":{"MD5":"8d1f5412cc6e58af2bdbff2e179f298d","SHA1":"5d01cd9701213f7fd4073507cdbe18f4b742baf7","SHA256":"efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d"},"RichPEHeaderHash":{"MD5":"1e7257fad0156a8620120920a4eba3d1","SHA1":"81c0a25338b94e6f37fd4b008a96ec206578ae8c","SHA256":"28b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e"},"Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","Product":"Paragon System Utilities","Copyright":"Copyright 1994-2017 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"]},{"Filename":"","Libraries":["ntoskrnl.exe","HAL.dll"],"ImportedFunctions":["RtlValidSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeInitializeEvent","KeWaitForSingleObject","ExGetPreviousMode","MmMapLockedPages","MmMapIoSpace","MmUnmapIoSpace","SeCaptureSubjectContext","SeReleaseSubjectContext","SeAccessCheck","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetRelatedDeviceObject","IoIs32bitProcess","PoRegisterSystemState","PoUnregisterSystemState","ObReferenceObjectByHandle","ObfDereferenceObject","ZwOpenFile","ZwClose","ZwOpenProcess","RtlCreateSecurityDescriptor","KeAttachProcess","KeDetachProcess","ZwDuplicateObject","ObQueryNameString","SePrivilegeCheck","RtlInitializeSid","RtlSubAuthoritySid","RtlLengthSid","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetGroupSecurityDescriptor","RtlSetOwnerSecurityDescriptor","RtlAllocateHeap","RtlFreeHeap","RtlCreateHeap","RtlDestroyHeap","__C_specific_handler","IoFileObjectType","PsLookupProcessByProcessId","RtlInitUnicodeString","HalReturnToFirmware"],"ExportedFunctions":"","MD5":"525ef6014f0ef20e44fe47c1d9980b69","SHA1":"cab45e9d03efa8a09595b99b275caadb8f250811","SHA256":"174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe","Imphash":"f4f462bcde0472cb6202214475f889b1","Machine":"AMD64","MagicHeader":"50 45 0 0","CreationTimestamp":"2022-08-11 08:04:23","RichPEHeaderMD5":"103ed1ac1ea56c3cc7db32fa7d2eae72","RichPEHeaderSHA1":"4888504201b2e54209e2098252644cf9c7dac7ba","RichPEHeaderSHA256":"180e1ac2cc854b49c7afdf2bd752147097fb55f5a5199a831885db6a4957ec10","AuthentihashMD5":"778ca6c522c672bdd509cd37339916c8","AuthentihashSHA1":"66f199e8edc9580a33c81d056b34b590481a7f01","AuthentihashSHA256":"015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615","Sections":{".text":{"Entropy":6.063036948579726,"Virtual Size":"0x16ac"},".data":{"Entropy":0.261554002666683,"Virtual Size":"0x140"},".pdata":{"Entropy":3.2173256031094004,"Virtual Size":"0x84"},".idata":{"Entropy":4.476341518700635,"Virtual Size":"0x7e2"},".rsrc":{"Entropy":3.218687569819314,"Virtual Size":"0x370"},".reloc":{"Entropy":2.1258145836939115,"Virtual Size":"0xc"}},"CompanyName":"Paragon Software GmbH","FileDescription":"A part of Paragon System Utilities","InternalName":"biontdrv","OriginalFilename":"biontdrv.sys","FileVersion":"","ProductName":"Paragon System Utilities","LegalCopyright":"Copyright 1994-2022 Paragon Software GmbH","ProductVersion":"1.5.1","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=DE, ST=Baden,Wrttemberg, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH","ValidFrom":"2021-10-27 00:00:00","ValidTo":"2022-11-09 23:59:59","Signature":"60efe8e490f73560084068cb01097a77ddc92a2b0a0c4fc2d148becc30dc16ca81fa83edad0813b37ad623ada902100d64b4b3e75cd38a858ca11a068b2b70a80ad3be0edd05f449b254108d9fcdf04bfefbcf2e976b3be1c5190efcadfddd3a98493c0e088b4e5d67396054d593fa176999cd14f49d928a36aec45214539d624cfda6f97dc77691dc4155a4b8348ce3910588c7a6c309c63e2b7ab45d4b09228f62b6127c094171c5e533a69eba287b1c15aa5797f79debf5ff378692cbe41925ff5a226bf3b521ce8c988cf7ecb655bba8e5b3a6ae70792df23b1bdc86cf1d5f43aa0cddd6fb1bc9ea7c70aae4e161e7abbb12a9c63b5cccbb4efd9cd680c1c126151746b996517a083eb73c6d30b7255e38c8e52f105a58969f53f7c64811a285629b1ffc1b364342680e55c26532a8eaae218430598031cc94c37adf26f80018bbfc6d54fcbd351683f2bcd61ab84af6ef2d9ab3322b0437343c6f69ad6bfafa56e6e0cd0ba5a769bb53772b2546d43d38375d224375bb29adf2a495f5c44b04a3efb9130594ab0690bc85538a4a612efb47d6dd0bb032196eb47e00c4a150052c860a112f46163c6cf071f6ee9ef928f5c895a206a9886f23f58e394f28415dcaf227cf2dc0690a0880362bb558ba140d084966593754a8dd896ff67e5e1b7abe130c2b503406d0c7ac387422b83973c4dffe8f4b7c0d17dc800463091e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"046a6191017da49a025dd21aa76934f7","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c7f1b7cbb054ecb1a659ffeafd5975fa","SHA1":"6b17d9dd7483829600f8e94e6134ad87fb667a78","SHA256":"d1a7a9b52e70c6bb75ec4b9a509be4367fc0e5d5edfcbeb62e443eda89596bef","SHA384":"38637492f7acb0de0ee97fc0cc2328241a9013943d0895834438c577d373e2909d583a790e2b78d4ed022a5b521a1891"}}],"Signer":[{"SerialNumber":"046a6191017da49a025dd21aa76934f7","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}],"Authentihash":{"MD5":"778ca6c522c672bdd509cd37339916c8","SHA1":"66f199e8edc9580a33c81d056b34b590481a7f01","SHA256":"015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615"},"RichPEHeaderHash":{"MD5":"103ed1ac1ea56c3cc7db32fa7d2eae72","SHA1":"4888504201b2e54209e2098252644cf9c7dac7ba","SHA256":"180e1ac2cc854b49c7afdf2bd752147097fb55f5a5199a831885db6a4957ec10"},"Description":"A part of Paragon System Utilities","Company":"Paragon Software GmbH","Product":"Paragon System Utilities","Copyright":"Copyright 1994-2022 Paragon Software GmbH","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"]}]}